![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/0c91e148b4724bf49895fc7278ebd295.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
目录扫描，存在源码泄露www.zip
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/f0cc08ea0141400286d4816fbd2079d0.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
ThinkPHP框架
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/4236bc0471604ac69ed681b8ec90e56a.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
ThinPHPV6.0.0
漏洞成因：ThinkPHP6任意文件操作漏洞分析
session可控，修改session，长度为32位，session后缀改为.php（加上.php后为32位）
然后再search搜索的内容会直接保存在/runtime/session/目录下，getshell
- 先注册一个账户
- 登录这个账户抓包，修改session
- 在搜索框写入一句话
key的值会被写入到session文件当中
访问shell路径
/runtime/session/sess_1234567890123456789012345678.php![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/9185d366a9a642d1ac4cfe39e29db40d.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
得到shell，但是发现和BUUCTF：[极客大挑战 2019]RCE ME这一题一样，有disable_function限制，php版本
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/0d6d69d9b1b34d56b1cc5e47bfe1baf9.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
disable_function绕过exp连上蚁剑，找个能上传文件的地方，上传exp，这里我还是和之前一样上传到/var/tmp/目录当中
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/469a956167c840329143bdb96075d370.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
修改我们exp执行命令为执行/readflag
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/464ed45cb8a44473b56c2cad6ca51716.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
最后包含这个文件即可得到flag
![BUUCTF：[GYCTF2020]EasyThinking](https://ctyun-collect-0531.gdoss.xstore.ctyun.cn/files/2023/10/10/69f4176857ba4019b31cc21f171db2a5.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "BUUCTF：[GYCTF2020]EasyThinking")
